Employees' Text Messages May Be Protected By Privacy Laws

(Published September 15, 2008)

 

It's natural to want to keep tabs on what employees are doing and saying over employer-provided equipment. But employers had better think twice before monitoring any electronic message content that's stored and transmitted by an outside provider.

 

A recent case describes limitations on employers' ability to obtain and review employees' text messages stored and transmitted by an outside provider without the employees' permission.

 

A California city's police department pagers used text-messaging services provided by a third party. The city had a policy on computer usage, Internet, and e-mail that prohibited personal use, affirmed employees' lack of privacy and confidentiality, and reserved the city's right to monitor and review activity. However, it had no official policy governing the use of pagers; its informal policy simply asked employees to pay for overage charges in the event they exceeded a monthly character limit.

 

One police officer exceeded the monthly limit numerous times and paid the city for the overages accordingly. In an effort to determine whether the monthly character limit might need to be increased for legitimate business use, the city requested and received transcripts of the officer's text messages, including personal messages to/from other officers, from the wireless company, without notifying or requesting permission from the police officer.

 

The officers involved filed suit against both the wireless company and the city. An appeals court ruled that the wireless company had violated the Stored Communications Act (SCA) by revealing the officer's text messages to his employer. The court also ruled that the city had violated the officer's 4th Amendment rights by reviewing the text messages. (Quon et al. v. Arch Wireless et al., 9th Cir., No. 07-55282, 2008)

 

Where The Employer Went Wrong

 

Avoid these mistakes made by the police department:

 

1. Its policies and practices were not consistent. Its policies warned that employees had no expectation of privacy and that it reserved the right to monitor usage. The "operational reality" was that the staff had been told that their pagers would not be audited so long as they agreed to pay for any overages.

 

2. It followed its informal policy and allowed the officers to reasonably rely on it. The officer had exceeded the monthly character limit before and had paid for the overages each time without anyone reviewing the text of the messages. Nevertheless, without warning, his text messages were audited by the department.

 

3. It could have used other, legal methods for accomplishing its stated goal. For one, it could have warned the officer that he was forbidden from using his pager for personal communications for one month, and that the contents of all of his messages would be reviewed during that time. Or it could have simply asked the officer for permission to review his messages.

 

Tip: If, like the police department in Quon, you use an outside provider to store or transmit company e-mail or texts, get written consent from your employees allowing for the outside provider's disclosure of the contents of all messages for which an employee is the originator, addressee, or intended recipient.

 

Employers Have Rights, Too

 

Don't despair: Employers are still allowed to monitor employees' electronic communications (i.e., e-mail and text messages), as long as:

 

• the communications are stored and transmitted on the employer's own equipment (i.e., its own server); and

 

• employees have advance notice that any and all workplace communications are subject to being monitored.

 

This second point is the key to ensuring that employees have no expectation of privacy in using employer-provided resources. The best way to do this is through a well-publicized and consistently enforced company policy.

 

Important: Stress to managers and supervisors the importance of avoiding "informal" statements and actions that are incongruent with company policy. A manager telling a new hire, "Oh, don't worry, no one here will ever bother to read your e-mail," would give that employee a reasonable expectation of privacy, despite what the company policy says.

 

Related Topic(s): Privacy Policy Guidelines - Electronic Communications